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Description 

[0001] This Invention relates to a credit card system 
and method, and more particularly, to a credit card sys- 
tem and method offering reduced potential of credit card 
number misuse. 

[0002] The development of retail electronic com- 
merce has been relatively slow In spite of the perceived 
demand for such trade. The single greatest deterrent to. 
the expansion of retail electronic commerce is the po- 
tential fort raud. This potential for fraud has been a major 
concern for the credit card companies and financial in- 
stitutions as well as the customers and the providers of 
the goods and services. 

[0003] The former are concerned about fraud be- 
cause essentially the financial institutions have to bear 
the initial cost of the fraud. Additionally, the credit card 
companies have an efficient credit card system which is 
working well for face to face transactions, i.e., "card 
present transactions where the credit card is physically 
presented to a trader and the trader can obtain the credit 
card number, compare signatures and in many cases 
photographs before accepting a particular credit card. 
[0004] The latter are equally concerned about fraud 
being well aware that ultimately the user must pay for 
the fraud. However, there are particular personal con- 
cerns for the consumer in that the fraudulent use of the 
credit card by misuse of the credit card number by a third 
party may not become apparent for some time. This can 
happen even If the card is still in his or her possession. 
Further, when fraud does occur the consumer has the 
task of persuading the credit card provider that fraud by 
another did indeed occur. 

[0005] There is also the additional fear of being over- 
charged on a credit card. There are thus particular risks 
for those credit card holders who have relatively high 
spending limits, in that if fraud should occur, it may be 
some considerable time before it is detected. One parr 
ticular form of fraud refen-ed to as "skimming" is partic- 
ularly difficult to control. What happens is that the card 
holder proffers his or her card at an establishment to 
make a transaction, the relevant infomiation is electron- 
ically and/or physically copied from the card and the 
card is subsequently reproduced. This can be a partic- 
ular problem with travelers particularly during an exten- 
sive period of travel as the fraudulent card may tum up 
In other places and it may be some considerable time 
before the fraud is detected. 

[0006] For remote credit card use, the credit card 
holder has to provide details of name, master credit card 
number, expiration date and address and often rfiany 
other pieces of information for verification; the storing 
and updating of the infomiation is expensive but neces- 
sary, This of itself is a considerable security risk as an- 
ybody will appreciate that this information could be used 
to fraudulently charge goods and services to the card 
holder's credit card account. Such fraudulent use is not 
limited to those people to whom the credit card informa- 
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tion has been given legitimately, but extends to anybody 
who can illegitimately obtain such details. A major prob- 
lem in relation to this form of fraud is that the credit card 
may still be In the possession of the legitimate holder as 
5 these fraudulent transactions are taking place. This Is 
often referred to as "compromised numbers" fraud. In- 
deed ail this fraud needs is one dishonest staff member, 
for example in a shop, hotel or restaurant, to record the 
credit card number. It Is thus not the same as card theft. 
10 [0007] The cunrent approaches to the limiting of credit 
card fraud are dependent on the theft of a card being 
reported and elaborate verification systems whereby al- 
tered patterns of use initiate some enquiry from the cred- 
it card company. Many users of credit cards have no 
15 doubt received telephone calls, when their use of the 
card has been exceptional, or otherwise unusual in the 
eyes of the organization providing the verification serv- 
ices. 

[0008] Thus, there have been many developments in 
an effort to overcome this fundamental problem of fraud, 
both in the general area of fraud for ordinary use of credit 
cards and for the particular problems associated with 
such remote use. 

[0009] One of the developments is the provision of 
smart cards which are credit card devices containing 
embedded electronic circuitry that can either store infor- 
mation or perform computations. Generally speaking 
they contribute to credit card security systems by using 
some encryption system. A typical example of such a 
smart card is disclosed in U.S. Patent No. 5,317,636 
(Vizcaino). 

[001 0] Another one of the developments is the Secure 
Electronic Transaction (SET) protocol which represents 
the collaboration between many leading computer com- 
panies and the credit card industry which is particularly 
related to electronic transmission of credit card details 
and in particular via the Internet. It provides a detailed 
protocol for encryption of credit card details and verifi- 
cation of participants in an electronic transaction. 
[001 1 ] Another method that is particularly directed to 
the Intemet Is described in U.S. Patent No. 5,715,314 
(Payne et al.). U.S. Patent 5,71 5,31 4 discloses using an 
access message that comprises a product Identifier and 
an access message authenticator based on a crypto- 
graphic key. A buyer computer sends a payment mes- 
sage that identifies a particular product to a payment 
computer. The payment computer is programmed to re- 
ceive the payment message, to create the access mes- 
sage, and to send the access message to a merchant 
computer. Because the access message is tied to a par- 
ticular product and a particular merchant computer, the 
access message can not be generated until the user 
sends the payment message to the payment computer. 
Because the access message is different from existing 
credit card fomnats, the access message is ill-suited for 
phone/mailorders andothertraditlonal credit card trans- 
actions. 

[0012] There are then specific electronic transaction 
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